← All tracked CVEs
Updated 20:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | GHSA-hwpq-hmq9-wj77: ONNX version_converter SIGSEGV in Upsample 6→7 adapter on zero-input node due to unguarded inputs()[0] access | secure-packages-26.05 | — | |
| In progress | GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource follows external symlinks, enabling out-of-tree read and size cap bypass | secure-packages-26.05 | — | |
| In progress | GHSA-hpj7-wq8m-9hgp: DigestAuthMiddleware leaks auth digest via cross-origin redirect to attacker-controlled domain | secure-packages-26.05 | — | |
| In progress | GHSA-g75f-g53v-794x: Bleach 6.3.0 ReDoS in email linkify when parse_email=True causing CPU exhaustion | secure-packages-26.05 | — | |
| In progress | GHSA-6hx8-3wjj-gr8g: Open redirect in WebOb: urljoin strips leading controls; HTTP exceptions bypass guards | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3546: HTTP parsers vulnerability: request smuggling via WebSocket upgrade edge case in aiohttp server-side | secure-packages-26.05 | — | |
| In progress | GHSA-54p9-h82j-f925: multidict 6.7–6.9 C-extension items-view union/subtraction leaks references, enabling remote memory exhaustion | secure-packages-26.05 | — | |
| In progress | GHSA-5p39-cfhj-2xmp: AnyIO process-pool workers leave stderr piped undrained, deadlocking on large stderr writes | secure-packages-26.05 | — | |
| In progress | GHSA-mq44-7p77-q5h7: aiohttp WebSocket client decompresses RSV1 frames without negotiated permessage-deflate | secure-packages-26.05 | — | |
| In progress | GHSA-mfx4-hv73-q22v: Request smuggling vulnerability in aiohttp server during WebSocket upgrade edge case | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3911: pypdf text extraction DoS: crafted PDFs with many XForms cause massive CPU/memory use | secure-packages-26.05 | — | |
| In progress | GHSA-9h9j-4vrj-gf7g: virtualenv prompt newline injection corrupts pyvenv.cfg, allows overriding home and interpreter metadata | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4055: JupyterLab Extension Manager uninstall command allows pip option injection via unvalidated extension name | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3910: pypdf outline parsing vulnerability allows crafted PDFs to cause long runtimes and high memory usage | secure-packages-26.05 | — | |
| In progress | GHSA-3325-v43h-43rv: JupyterLab unvalidated extension name in uninstall lets pip option injection for file read/SSRF/write | secure-packages-26.05 | — | |
| In progress | GHSA-h5v5-8746-g7mm: Authenticated users bypass JupyterLab plugin manager locks via /lab/api/plugins | secure-packages-26.05 | — | |
| In progress | GHSA-vmhf-c436-hxj4: JupyterLab Extension Manager XSS via javascript: URLs in PyPI package homepage metadata | secure-packages-26.05 | — | |
| In progress | GHSA-4cc2-g9w2-fhf6: python-zeep 4.0.0–4.3.2 ignored forbid_external, allowing SSRF via transitive WSDL/XSD imports | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3547: aiohttp WebSocket client decompresses RSV1 frames without negotiated permessage-deflate extension | secure-packages-26.05 | — | |
| In progress | GHSA-x33g-cr3x-6449: PyJWT accepts inconsistent OKP JWKs: x/d mismatch permits DPoP sender-constrained token bypass | secure-packages-26.05 | — | |
| In progress | GHSA-2fqr-mr3j-6wp8: aiohttp CookieJar save/load loses host-only flag, sending cookies to subdomains | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3628: h2 <=4.4.0 forwards duplicate Host headers, causing HTTP/1.1 smuggling on downgrade | secure-packages-26.05 | — | |
| In progress | GHSA-3jqq-pw4j-pqcj: JupyterLab Plural-Forms regex not end-anchored allows arbitrary JavaScript via malicious language packs | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4053: Unbounded varint decoding in python-hyper/hpack causes O(n^2) DoS on malformed input | secure-packages-26.05 | — | |
| In progress | GHSA-3hv7-mjh2-fv65: Tornado HTTPServerRequest parses query strings without field limit, causing DoS risk | secure-packages-26.05 | — | |
| In progress | GHSA-5639-2j2p-m4mx: Windows: Mako TemplateLookup drive-letter URIs bypass traversal check, enable arbitrary file disclosure | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-2689: Null deref in ONNX Upsample 6→7 adapter on zero-input node during convert_version | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4141: Deeply nested JWT payload triggers uncaught RecursionError pre-verification, causing DoS in PyJWT | secure-packages-26.05 | — | |
| In progress | GHSA-8423-8fgw-73vq: httputil.parse_multipart_form_data splits before max_parts check, memory amplification pre-auth HTTP DoS | secure-packages-26.05 | — | |
| In progress | GHSA-4m7w-qmgq-4wj5: Keep-alive connection reuse bypasses TLS SNI check when server_hostname changes between requests | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3670: JupyterLab PyPI extension manager allows blocklist bypass via package name canonicalization mismatch | secure-packages-26.05 | — | |
| In progress | GHSA-jg22-mg44-37j8: Arbitrary code execution vulnerability in aiohttp CookieJar.load() via untrusted input | secure-packages-26.05 | — | |
| In progress | GHSA-89vp-jrxv-24w8: JupyterLab extension manager blocklist bypass via weak PyPI name normalization enables installing blocked extensions | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-4056: JupyterLab Plural-Forms header regex allows arbitrary JS execution via malicious language packs | secure-packages-26.05 | — | |
| In progress | GHSA-m6qw-4cw2-hm4m: Header injection via attacker-controlled multipart/payload headers in aiohttp MultipartWriter/Payload | secure-packages-26.05 | — | |
| In progress | GHSA-6hr6-w5qg-qmwg: h2 <=4.4.0 forwards multiple Host headers, enabling HTTP/2 to 1.1 request smuggling (CWE-444) | secure-packages-26.05 | — | |
| In progress | GHSA-gj48-438w-jh9v: Bleach clean/Cleaner fails to sanitize javascript: in formaction on submit controls | secure-packages-26.05 | — | |
| In progress | GHSA-42vr-xj54-vc7v: Deeply nested JWT payload causes pre-auth DoS via uncaught RecursionError in PyJWT | secure-packages-26.05 | — | |
| In progress | PYSEC-2026-3943: WebOb open redirect: urljoin strips leading control characters/spaces, bypassing checks and enabling off-host | secure-packages-26.05 | — |